DLP across email, SharePoint, OneDrive, Teams and devices

What this check looks at

Checks that enforced DLP policies cover every location for everyone: Exchange email, SharePoint, OneDrive, Teams and devices.

A DLP policy covers only the locations it is applied to: Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, and devices. The devices location is endpoint DLP, which watches files on Windows and macOS computers being copied to USB, printed, uploaded to websites or pasted elsewhere. Each location can be set to all accounts or sites, or to particular ones.

The check looks across all enforced DLP policies and fails for each of the five locations that no enforced policy covers with All, naming the gaps. A location applied to some users or sites counts as not covered for everyone. It passes when the enforced policies between them cover all five for everyone, and gives the same results as NL-PVW-101 when no policy is enforced.

DLP on one route simply moves data to another. A policy on email alone is sidestepped by sharing the file from OneDrive, pasting it into a Teams chat, uploading it to personal webmail in the browser or copying it to a USB stick. People working around a block, and attackers taking data out, both go by the route nobody watches.

Why it matters

Sensitive data leaves by whichever route is not watched. A policy on email alone is sidestepped by a OneDrive link, a Teams chat or a USB stick.

A typical case: a business has an enforced DLP policy on Exchange that blocks customer data going to outside addresses. A member of staff who is blocked from emailing a customer list to their personal account uploads the spreadsheet to their personal Google Drive in the browser instead. Endpoint DLP would have blocked the upload, or at least recorded it.

Partial coverage also gives false comfort: the business reports to its board or insurer that DLP is in place, when the routes most often used for taking data are not covered.

CISA SCuBA MS.DEFENDER.4.2v1 asks that DLP covers Exchange, OneDrive, SharePoint, Teams chat and devices, and ISO 27001 A.8.12 asks for data leakage prevention wherever sensitive data is processed. Teams and devices need Microsoft 365 E5 or an E5 Compliance add-on; Business Premium and E3 can cover email, SharePoint and OneDrive, and should record the other two as a licensing gap.

How to fix it

Where: Microsoft Purview portal → Data loss prevention → Policies

Before you start

• For devices, onboard Windows and macOS devices to Purview first, and check the licence (Microsoft 365 E5 or E5 Compliance).
• Add each new location in test mode before enforcing it.

Step by step

1. 1See which locations are covered. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run Get-DlpCompliancePolicy | Select-Object Name, Mode, ExchangeLocation, SharePointLocation, OneDriveLocation, TeamsLocation, EndpointDlpLocation and note, for the enforced policies, each location that is missing or not All.
2. 2Check licences for Teams and devices. In the Microsoft 365 admin centre, go to Billing > Your products. Teams and devices need Microsoft 365 E5, E5 Compliance or E5 Information Protection and Governance; without them, cover the other three locations and record the rest against the finding.
3. 3Onboard devices if devices are missing. In the Purview portal, go to Settings > Device onboarding and turn device onboarding on. Devices already onboarded to Microsoft Defender for Endpoint appear under Devices automatically; others are onboarded with the package from the Onboarding page, deployed through Intune. Check the devices show as onboarded before going on.
4. 4Add the missing locations in simulation first. Adding a location to an enforced policy enforces it at once, so create a second policy from the same template for the missing locations: Solutions > Data loss prevention > Policies > Create policy, set each missing location to All (all accounts, all sites, all devices), and choose simulation mode. For devices, set the rule actions under "Audit or restrict activities on devices" (for example block upload to cloud services and copying to removable USB, with override).
5. 5Review, then turn the new policy on. After a week or two, review its matches in Activity explorer for each location, tune what matches too much, then edit the policy and choose "Turn the policy on immediately" (or Set-DlpCompliancePolicy -Identity "<policy>" -Mode Enable).
6. 6Confirm the change. Rerun the Get-DlpCompliancePolicy command: between them, enforced policies show All for Exchange, SharePoint, OneDrive, Teams and endpoint locations. On a test device, try copying a file containing test card numbers to a USB stick: it is blocked or audited as the rule says, and the event appears in Activity explorer.

What users will notice

Sensitive information is checked wherever it goes: email, SharePoint, OneDrive, Teams and, with endpoint DLP, copying to USB or uploading from a device.

How to confirm it worked

Get-DlpCompliancePolicy | Select-Object Name, ExchangeLocation, SharePointLocation, OneDriveLocation, TeamsLocation, EndpointDlpLocation shows All in each for an enforced policy.

Frameworks and controls

This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• DLP policy locations (Microsoft Learn)

Related checks

• How to keep email and files with Purview retention policies
• SharePoint and OneDrive external sharing: the safe setting
• Safe Attachments for SharePoint, OneDrive and Teams
• How to stop guests resharing SharePoint files

The full Microsoft 365 security checklist, worst first